CEH Advanced Topics: Wireless, Cloud, IoT, Cryptography — 10 Questions

Question 1

A forensic analyst examines a firmware image extracted from an IoT thermostat and finds hardcoded credentials for a cloud backend. Which phase of the IoT attack lifecycle does this represent?

Accepted Answer

Reconnaissance. Finding hardcoded credentials in firmware is an act of information gathering about the target device and its backend. This corresponds to the Reconnaissance phase of the IoT attack lifecycle, where attackers collect data to identify vulnerabilities. The exploitation phase would involve using the credentials to gain access, not just discovering them.

Answer

Weaponization

Answer

Installation

Answer

Exploitation

Question 2

Which TWO of the following are valid attacks against wireless networks? (Choose two.)

Accepted Answer

De-authentication attack. Evil twin involves a rogue AP, and de-authentication disconnects clients by targeting 802.11 management frames. SSRF is a web application vulnerability, not a wireless network attack. Dictionary attacks are a method for cracking passwords or keys, which can be used against wireless networks (e.g., WPA/WPA2 pre-shared keys) but are a general technique rather than a specific wireless network attack type. Replay attacks are also a generic technique that can be applied in wireless contexts (e.g., WEP cracking) but are not exclusively wireless-specific. The question asks for specific attacks against wireless networks, making evil twin and de-authentication the most appropriate choices.

Answer

SSRF

Answer

Dictionary attack

Answer

Replay attack

Question 3

Which TWO of the following are valid cryptanalytic attacks?

Accepted Answer

Replay attack. Birthday attack exploits hash collisions; replay attack reuses captured data. Downgrade attack forces a system to use a weaker cryptographic protocol or cipher suite, which is a form of cryptanalytic attack. SQL injection and XSS are web application attacks, not cryptanalytic.

Answer

SQL injection

Answer

Cross-site scripting (XSS)

Question 4

An analyst notices that a cloud application is vulnerable to Server-Side Request Forgery (SSRF). Which of the following is the MOST effective mitigation against SSRF attacks in a cloud environment?

Accepted Answer

Block outbound traffic to internal IP ranges except through a configured forward proxy. Restricting the application from making requests to internal IP ranges (e.g., 169.254.169.254, a common address for cloud metadata services) is a key defense against SSRF.

Answer

Implement strict input validation on all user-supplied URLs

Answer

Disable the use of external URLs in application features

Answer

Use a web application firewall (WAF) with SSRF signatures

Question 5

An organization is using a cloud IAM policy that allows all actions on all resources. Which TWO security issues are MOST directly related to this configuration? (Choose two.)

Accepted Answer

Excessive privileges. A permissive IAM policy directly grants excessive privileges, which can be exploited to access and expose sensitive data from various cloud resources, including cloud storage buckets.

Answer

Vulnerable software libraries

Answer

Weak encryption algorithms

Answer

Insecure MQTT configuration

Question 6

During a cloud penetration test, a tester discovers that an AWS IAM role has the following policy: `{"Effect":"Allow","Action":"*","Resource":"*"}`. This policy is attached to an EC2 instance. Which of the following attacks is the tester MOST likely to perform next?

Accepted Answer

SSRF attack to access the instance metadata service and obtain the IAM credentials. The IAM policy grants full administrative access to the AWS account. To leverage this, the tester must first obtain the temporary credentials associated with this role. This is typically done by exploiting a Server-Side Request Forgery (SSRF) vulnerability in an application running on the EC2 instance to query the Instance Metadata Service (IMDS) at `http://169.254.169.254/latest/meta-data/iam/security-credentials/role-name`. Once the credentials are obtained, the tester can then enumerate and abuse the permissions, such as creating users, accessing data, or escalating privileges further.

Answer

Perform a dictionary attack against the root user password

Answer

Use Pacu to enumerate S3 buckets

Answer

Exploit a container escape vulnerability in Docker

Question 7

Which TWO of the following are common weaknesses in IoT devices that are often exploited by attackers?

Accepted Answer

Use of default or hard-coded credentials. Many IoT devices ship with default usernames and passwords (e.g., 'admin/admin') or hard-coded credentials embedded in firmware. Attackers can easily discover these through simple web searches or Shodan scans, then gain unauthorized access to the device and potentially the entire network. Furthermore, many IoT devices communicate using insecure protocols or implement secure protocols like MQTT without proper encryption (e.g., TLS/SSL), making data vulnerable to eavesdropping, tampering, and man-in-the-middle attacks.

Answer

Use of hardware security modules (HSM)

Answer

Implementation of secure boot

Answer

Firmware update mechanism with signed updates

Question 8

During a cloud penetration test, a tester discovers an S3 bucket that allows public listing and write access. Which of the following is the MOST likely misconfiguration?

Accepted Answer

IAM roles attached to the bucket allow anonymous access. That IAM roles attached to the bucket allow anonymous access. This is a common misconfiguration where an IAM role's trust policy permits any user to assume the role, granting them the permissions of that role, which could include listing and writing to the bucket. Option B is incorrect because s3:GetObject and s3:PutObject do not allow listing the bucket; s3:ListBucket is required for listing.

Answer

The bucket is in a different region than the EC2 instance

Answer

The bucket policy grants 's3:GetObject' and 's3:PutObject' to 'Principal': *

Answer

Server-side encryption is disabled

Question 9

A security analyst captures network traffic and sees the following: Client sends a SYN, server responds with SYN-ACK, then client sends ACK. Immediately after, the client sends an encrypted payload. This traffic is consistent with which phase of a WPA2 attack?

Accepted Answer

De-authentication attack. The captured TCP three-way handshake followed by encrypted payload indicates that a client has just successfully reconnected to the wireless network. This reconnection occurs as a result of a deauthentication attack, which disconnects the client and forces it to reassociate. Therefore, this traffic is consistent with the reconnection phase triggered by a deauthentication attack within a WPA2 attack sequence.

Answer

WPA2 4-way handshake exchange

Answer

WPS PIN exchange

Answer

WEP initialization vector capture

Question 10

Which TWO of the following are cloud-specific security threats?

Accepted Answer

S3 bucket misconfiguration. S3 bucket misconfiguration is a cloud-specific threat because it involves improper access control settings on Amazon S3 storage, such as public read/write permissions, which can lead to data exposure or unauthorized access. This threat is unique to cloud environments where object storage is managed via APIs and IAM policies, unlike traditional on-premises storage. SSRF (Server-Side Request Forgery) in cloud environments is also cloud-specific because it can be exploited to access sensitive cloud metadata services (e.g., AWS EC2 metadata service, Azure Instance Metadata Service) which provide information like temporary credentials or instance details, a vector unique to cloud infrastructure.

Answer

SQL injection

Answer

De-authentication attack

Answer

ARP spoofing